Skip to content

Add baseImage validation, status field, and documentation - #396

Open
ivanauth wants to merge 4 commits into
authzed:mainfrom
ivanauth:fix/baseimage-validation
Open

Add baseImage validation, status field, and documentation#396
ivanauth wants to merge 4 commits into
authzed:mainfrom
ivanauth:fix/baseimage-validation

Conversation

@ivanauth

@ivanauth ivanauth commented Dec 9, 2025

Copy link
Copy Markdown
Contributor

Summary

Improvements to the alternative container registry feature (PR #367):

  • Validate baseImage format: Reject tags (:tag) and digests (@sha256:...) in baseImage field, while correctly allowing port numbers in registry URLs (e.g., registry:5000/image)
  • Add CEL validation: Early validation at Kubernetes API level for faster feedback
  • Surface resolved base image in status: New status.resolvedBaseImage field for debugging
  • Add documentation and examples: User-facing docs with common use cases and pitfalls

Relates to #387

Changes

  • Add validation in pkg/config/config.go to reject invalid baseImage values
  • Add ResolvedBaseImage field to ClusterStatus in pkg/apis/authzed/v1alpha1/types.go
  • Add CEL validation rules to CRDs
  • Add examples/alternative-registry/ with README and example manifests
  • Add comprehensive tests for validation edge cases

@ivanauth
ivanauth force-pushed the fix/baseimage-validation branch from 04effaa to e6ded22 Compare December 13, 2025 02:17
Comment thread examples/alternative-registry/README.md Outdated
@ivanauth
ivanauth force-pushed the fix/baseimage-validation branch from 25db2cc to 641c590 Compare March 5, 2026 20:52
The two-secret credentials test was not updated when ResolvedBaseImage
was added to MigrationConfig. Update the expected status to include
ResolvedBaseImage and the correct migration hash, and use the same
tlsSecretName as other test cases for consistent hashing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants